Privacy Policy

This policy and our Cookies Policy sets out how Cerebra – For Brain Injured Children and Young People, uses and protects your personal information, including data from your use of our website.

Protecting data privacy is core to our platform. We collect very little information about you, store that information carefully, and never share it without your permission. Payment information is used solely for billing purposes and handled securely. This privacy notice discloses the privacy practices for Relay Your Way www.relayyourway.org (the "Event") organised by Cerebra (the "Organiser").

Cerebra (‘we’, ‘us’, ‘our’) is the Data Controller of your personal data. Our registered address is The MacGregor Office Suite, Jolly Tar Lane, Carmarthen, SA31 3LW, and we can be contacted here.

We do not trade personal data for commercial purposes and will only disclose it if required by law, if it is necessary to arrange your event attendance, or if it is with your consent. Cerebra uses providers based in the European Economic Area to process supporter data.

Cerebra is registered with the Information Commissioner’s Office under number Z6201581 is a registered charity under number 1089812 and a registered company limited by guarantee under number 4336208 (England and Wales).

You can change how we contact you at any time, simply by contacting us using our contact form or calling us on 01267 244200.

As part of our commitment to you, we have appointed a Data Protection Officer, whose name is Ralph Nicholls. You can contact Ralph either by using our contact form or writing to the address above.

This policy was updated to show that we are adhering to the new General Data Protection Regulation (GDPR), which came into force in May 2018.

What We Collect

In order for you to create an account on www.relayyourway.org and use our services, we need to collect and process some information. Depending on your use of the Services, that may include:

information (such as your name, email and postal addresses, telephone number, and country of residence) that you provide by completing forms on the Event, including if you register as a user of the Services, subscribe to our newsletters, upload or submit any material through the Event, or request any information;
your login and password details, in connection with the account sign-in process;
details of any requests or transactions you make through the Services;
information about your activity on and interaction with Event, such as your IP address and the type of device or browser you use;
communications you send to us (for example, when you ask for support, send us questions or comments, or report a problem);
and information that you submit to Event in the form of comments, contributions to discussions, or messages to other users.

What’s Private

This data will not be publicly displayed or revealed to other users:

any payment information you provide;
your password details;
your IP address;
communications you send to us (for example, when you ask for support, send us questions or comments, or report a problem)

We don’t give your personal information to any third-party services, except when it’s necessary to provide Event Services (like when we partner with payment processors or our apparel supplier). When we share data with third-party services that support our delivery of the Event Services, we require that they protect your personal information to the same standards we do.

We do reserve the right to disclose personal information when we believe that doing so is reasonably necessary to comply with the law or law enforcement, to prevent fraud or abuse, or to protect Organiser’s legal rights.

What’s Public

When you create an account, we create a basic profile page for you on Event, containing your profile name, stage number, bio (if you've created one) and photo (if you've uploaded one). Whenever your account name appears on Event (for instance, when you register for a stage, receive a donation, or appear on the runner leaderboards), people can click your account name to see your profile. Here are some of the things that will be publicly viewable on your profile, or elsewhere on Event:

the account name;
any information you choose to add to your profile (a picture or bio);
donations received and messages from donors;

Uses of Your Personal Information

We process your personal data under the following legal bases:

Performance of a contract (e.g., registering you for the event).
Legitimate interests (e.g., analysing website use, improving services).
Legal obligations (e.g., tax or fraud prevention).
Consent (e.g., marketing emails, which you may opt out of)

We will use the personal information you provide to:

identify you when you sign in to your account;
enable us to provide you with the Services;
send you marketing communications we think you may find useful, but only in accordance with your preferences;
present information to you when you use the Services which we believe will be of interest based on your geographic location and previous use of the Services;
administer your account with us;
enable us to contact you regarding any question you make through the Services;
analyse the use of the Services and the people visiting to improve our content and Services;
and use for other purposes that we may disclose to you when we request your information.

We take securing your data and preserving your privacy very seriously. We never post anything to your Facebook, Twitter, or other third-party accounts without your permission. Event participants never receive donors’ credit card details or other payment information. We do not and will not sell your data.

We retain personal data only for as long as necessary for the purposes outlined in this policy. Registration data will be kept for six years after the event, unless required by law.

We may share personal data with trusted third-party service providers, such as Stripe for payment processing and email providers for communications. These processors are contractually required to protect your information. Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner’s Office.

Payment Information

Payment information including your name, address, and credit card information is required for some Event services. This information is used solely for billing purposes by our PCI-certified payment provider, Stripe.

‘Stripe has been audited by a PCI-certified auditor, and is certified to PCI Service Provider Level 1. This is the most stringent level of certification available.’ Source: https://stripe.com/help/security

Your credit card information is encrypted and transmitted to Stripe securely; it is never stored on Organiser systems, and no one at Organiser can access it. Read more about security at Stripe – https://stripe.com/help/security

Privileged members of the Organiser team have access to your credit card’s expiration date to ensure your payment information remains valid.

Cookies

We use cookies and file logs to (i) store information so you will not have to re-enter it during your visit or in subsequent visits; (ii) maintain sessions for authenticated users; and (iii) monitor aggregate metrics such as total number of visitors and pages viewed.

For more details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

Email

We want to communicate with you only if you want to hear from us. We try to keep emails to a minimum and give you the ability to opt out of any marketing communications we send.

We will send you an email relating to your personal transactions. You will also receive certain marketing email communications, in accordance with your preferences, and from which you may opt out at any time.

We may send you service-related announcements on the rare occasions when it is necessary to do so.

Wrap-up

To modify or delete the personal information you have provided to us, please log in and update your profile. We may retain certain information as required by law or for necessary business purposes.

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data, unless we have a legal obligation to retain it.
Object to processing in certain circumstances.
Withdraw consent for marketing at any time.

You can exercise these rights by contacting [email protected]

You may request a copy of your personal data free of charge. However, we may charge a reasonable fee if your request is manifestly unfounded or excessive.

People under 18 (or the legal age in your jurisdiction) are not permitted to use Event on their own, and so this privacy policy makes no provision for their use of Event. We do not knowingly collect personal data from children under 18 without parental consent. Parents or legal guardians must register on behalf of minors.

Questions?

If you have questions or suggestions, please email [email protected]